Looking for breakthrough ideas for innovation challenges? Try Patsnap Eureka!

Network-based infection detection using host slowdown

a network-based infection and host technology, applied in the direction of unauthorized memory use protection, instruments, generating/distributing signals, etc., can solve the problems of ineffective conventional scanning engines based on known bad file signatures, pcs and computer networks are vulnerable to attacks, and can not detect malicious files in time, so as to facilitate host malware (or host change) detection

Active Publication Date: 2009-05-14
POLYTECHNIC INSTITUTE OF NEW YORK UNIVERSITY
View PDF6 Cites 19 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

Today, PCs and computer networks are vulnerable to attacks from a variety of globally-distributed sources, who range in size and scope from large-scale international criminal organizations to individual hackers, and whose tactics continually evolve.
Rootkits infect a host system by either replacing or attaching themselves to system components, thereby making their detection by the operating system extremely difficult.
Given the capability of rootkits to mask their activity, conventional scanning engines based on known bad file signatures are often completely ineffective.
In other words, often, a malware infection will be totally stealth and can remain for great lengths of time without being detected.
Unfortunately, to date, there are no established mechanisms that can reliably detect the presence of such malware once a computer is infected with them.
Aside from practical difficulties in maintaining a reference copy, systems are not typically static—legitimate changes take place quite frequently within a system.
These changes make simple reference copy file comparison approach inapplicable in many, if not most, cases.
However, one deficiency of this class of detectors is that malicious software developers are aware of these techniques and are constantly developing their malware products to evade such detection methods.

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Network-based infection detection using host slowdown
  • Network-based infection detection using host slowdown
  • Network-based infection detection using host slowdown

Examples

Experimental program
Comparison scheme
Effect test

Embodiment Construction

[0022]The present invention may involve novel methods, apparatus, message formats, and / or data structures to facilitate the detection of malware infections in a host system. The present invention may do so by passively observing and measuring slowdown in the host system's responses to known network events. The following description is presented to enable one skilled in the art to make and use the invention, and is provided in the context of particular applications and their requirements. Thus, the following description of embodiments consistent with the present invention provides illustration and description, but is not intended to be exhaustive or to limit the present invention to the precise form disclosed. Various modifications to the disclosed embodiments will be apparent to those skilled in the art, and the general principles set forth below may be applied to other embodiments and applications. For example, although a series of acts may be described with reference to a flow dia...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

PUM

No PUM Login to View More

Abstract

Host malware (or change) may be detected by (1) receiving baseline set of response time information for each of one or more transactions involving (A) the host and (B) at least one peer of the host, (2) determining or receiving a later set of response time information for each of the one or more transactions involving the host and the at least one peer of the host, and (3) determining whether or not host slowdown has occurred using the baseline set of response time information and the later set of response time information. The execution of a host malware (or change) protection policy may be controlled using at least the determination of whether or not host slowdown has occurred.

Description

§0. PRIORITY CLAIM[0001]This application claims the benefit of U.S. Provisional Patent Application Ser. No. 60 / 986,927 (incorporated herein by reference and referred to as “the '167 provisional”), titled “NON-HOST BASED INFECTION DETECTION VIA SYSTEM SLOWDOWN” filed on Nov. 9, 2007, and listing Nasir MEMON and Husrev T. SENCAR as the inventors. The present invention in not limited to requirements of the particular embodiments described in the '167 provisional.§1. BACKGROUND OF THE INVENTION[0002]§1.1 Field of the Invention[0003]The present invention concerns detecting an infection in a host. In particular, the present invention concerns detecting malware infections in a host by passively observing and measuring host slowdown in responses to known network events.[0004]§1.2 Background Information[0005]Today, PCs and computer networks are vulnerable to attacks from a variety of globally-distributed sources, who range in size and scope from large-scale international criminal organizatio...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

Application Information

Patent Timeline
no application Login to View More
Patent Type & Authority Applications(United States)
IPC IPC(8): G06F21/00
CPCH04L63/1416G06F21/552
Inventor MEMON, NASIRSENCAR, HUSREV TAHASHANMUGASUNDARAM, KULESH
Owner POLYTECHNIC INSTITUTE OF NEW YORK UNIVERSITY
Who we serve
  • R&D Engineer
  • R&D Manager
  • IP Professional
Why Patsnap Eureka
  • Industry Leading Data Capabilities
  • Powerful AI technology
  • Patent DNA Extraction
Social media
Patsnap Eureka Blog
Learn More
PatSnap group products